CVE-2026-107798

Received Received - Intake

Stored XSS in JiveJdon TextStyle Filter

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: VulnCheck

Description

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to execute JavaScript when other users click or hover over rendered links.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107798

Affected Vendors & Products

Vendor	Product	Version / Range
banq	jivejdon	595d8d227fcdedf6f3b73540dd9f5d12dab399fe

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in the jivejdon software. It exists in the TextStyle filter, which is enabled by default. Attackers can exploit it by posting messages containing malicious javascript: links or specially crafted URLs. When other users click or hover over these links, JavaScript code executes in their browsers.

Impact Analysis

If you use jivejdon, attackers could steal your session cookies, redirect you to malicious sites, or perform actions on your behalf. This could lead to unauthorized access to your account or sensitive data. The impact depends on your user privileges and the actions you take while logged in.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized access to personal data or allowing data exfiltration. For HIPAA, it might compromise protected health information if exposed. Organizations using jivejdon may fail compliance requirements for data protection and user access controls.

Mitigation Strategies

Disable the TextStyle filter in jivejdon or update to a patched version. Review user-generated content for malicious URLs, particularly those using javascript: or quote-breaking patterns. Implement input validation and output encoding for all user inputs.

Hi! I’m here to help you understand CVE-2026-107798. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70